ITIL4F ITIL Management Practices Practice Question
An IT service desk analyst receives a call that users cannot access the CRM system. According to ITIL 4, what should the analyst do FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Log the incident and attempt to restore service
The first step in incident management is to log and classify the incident to restore service as soon as possible. Root cause analysis belongs to problem management, which is initiated later if needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escalate to the service desk manager immediately
Why it's wrong here
Immediate escalation to a service desk manager is premature and bypasses established incident management procedures. ITIL 4 advocates for initial logging, classification, and diagnosis by the service desk analyst to attempt resolution at the first point of contact. Escalation, whether functional or hierarchical, is a subsequent step reserved for incidents that cannot be resolved within agreed service level targets or by the current support level, ensuring resources are utilized effectively.
- ✓
Log the incident and attempt to restore service
Why this is correct
Logging the incident is the foundational first step in the ITIL Incident Management practice, providing a formal record for tracking, communication, and analysis. Following this, the primary objective is to restore normal service operation as quickly as possible to minimize business impact. The service desk analyst should then proceed with initial diagnosis and attempt to resolve the incident based on available knowledge and tools before considering other actions.
- ✗
Initiate a problem record to find the root cause
Why it's wrong here
Initiating a problem record immediately is an incorrect first action because problem management focuses on identifying and eliminating the root cause of incidents, which is a distinct and typically subsequent process. Incident management's immediate goal is service restoration, not root cause analysis. A problem record is usually created after an incident has been resolved, or when multiple similar incidents indicate an underlying issue, requiring a more in-depth investigation.
- ✗
Submit a change request to fix the system
Why it's wrong here
Submitting a change request is not the immediate action when users cannot access a system. Change enablement (formerly change management) is a controlled process for making modifications to services or service components, requiring assessment, authorization, and planning. While a change might ultimately be required to permanently fix an underlying issue, the initial response to an incident is to restore service, often through a workaround or known error resolution, not to immediately initiate a formal change.
Go deeper
Related to this question
About these practice questions
One of 531 original ITIL4F practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ITIL4F practice question is part of Courseiva's free PeopleCert certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ITIL4F exam.